Install PostgreSQL 16 (Hardened)

Prerequisites

• An account on the target cloud with permission to launch VM instances (no special IAM roles are required by this product unless stated below — IAM required: none).
• An SSH key pair registered in the target cloud (all access is key-only; password SSH is disabled).
• Instance size ≥ 4 vCPU (pricing floor; 8 vCPU recommended).
• No internet access or external dependency is required at deploy time — the image is self-contained.

AWS

1. Subscribe and launch; pg-firstboot.service runs initdb on first boot and the same local-only posture applies (peer auth only in pg_hba.conf).
   Expected result `sudo -u postgres pg_isready` → accepting connections.
2. For in-VPC clients: set listen_addresses in /var/lib/pgsql/data/postgresql.conf, add a scram-sha-256 line for your subnet to /var/lib/pgsql/data/pg_hba.conf, `sudo systemctl restart postgresql`, and open 5432 in the security group to that subnet only.
   Expected result psql from an app instance in the subnet connects; the internet cannot.

Google Cloud

1. Deploy from the Marketplace listing (or the deployment package): shielded VM, OS Login, IAP-only SSH — 5432 is NOT exposed by the package by default.
   Expected result gcloud compute ssh <vm> --tunnel-through-iap works; `sudo -u postgres pg_isready` reports accepting connections.
2. For in-VPC clients: set listen_addresses in postgresql.conf, add a pg_hba.conf rule for your subnet, restart postgresql, and add a firewall rule for 5432 from that subnet only.
   Expected result psql from an app VM in the subnet connects; the internet cannot.

Validate

sudo -u postgres pg_isready   → 'accepting connections'

First boot: GCE: the cluster was initialized by the distro packages at image build; service enabled. AWS: pg-firstboot.service runs initdb on first boot (guarded by /var/lib/pgsql/data/PG_VERSION), then postgresql.service starts. Ready when pg_isready succeeds (seconds after boot). No credential is generated.

First login / credentials

1. SSH in with the key pair you chose at launch (AWS: ssh ec2-user@<public-ip>; GCP: gcloud compute ssh <vm> --tunnel-through-iap).
2. Open a superuser shell with `sudo -u postgres psql` — the postgres role has no password; access is peer authentication through the local postgres OS account.
3. Create your own role and database (CREATE ROLE app LOGIN PASSWORD '...'; CREATE DATABASE app OWNER app;) before enabling any network access — 5432 listens on localhost until you change listen_addresses and pg_hba.conf.

Secure it

• Restrict SSH (22) to your own IP range in the cloud firewall/security group.
• Open application ports only per the ports table — closed-by-default is deliberate.
• Volume encryption: use your cloud's native volume encryption (enabled by default on most accounts); the image adds no proprietary encryption layer.

Costs & quotas

Software is billed by the marketplace at the listed rate; infrastructure (VM, storage, egress) is billed by your cloud at its standard rates. The recommended size fits default service quotas in most accounts — if you scale out, review your cloud's quota console before launch.

Next: configuration · troubleshooting · security notes